Privacy Policy for Wortavia
This policy explains how personal data may be processed when you use the Android app Wortavia.
1. Controller
Mike Lennartz
trading as Tavirio Games
Königsallee 23
41747 Viersen
Germany
Email: taviriogames@gmail.com
2. Local game data
To provide the game, Wortavia stores progress, coins, completed levels, statistics, streaks, settings and the state of an unfinished puzzle locally on your device. Tavirio Games does not store this data on its own servers and normally cannot access it. Local storage is used to provide the app features you request.
You can remove local data through Android's app-data settings or by uninstalling Wortavia. The optional save export/import feature lets you choose a file on your device or another destination through Android. Such copies are outside the app's local storage and must be deleted separately by you.
3. Google Mobile Ads / AdMob
Wortavia includes the Google Mobile Ads SDK (AdMob). For users in the European Economic Area, the provider is in particular Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The Mobile Ads SDK may automatically process and transmit to Google the IP address (which may indicate an approximate location), app interactions, diagnostic data, and device or other identifiers such as an advertising ID or App Set ID. Processing may serve ad delivery and measurement, analysis, fraud prevention, security and compliance. Some rewarded ads are voluntary.
Where consent is required, it is requested through the app's consent management before the corresponding advertising processing. Consent can be changed or withdrawn for the future when the privacy-options entry is available in the production ad configuration.
See Google's Privacy Policy and how Google uses data from partner apps.
4. Google User Messaging Platform (UMP)
Wortavia includes Google's User Messaging Platform to display privacy information and store or respect consent decisions. Access to or storage of information on your device for this purpose follows your choice or, where legally permitted, the technical requirements of managing that choice.
5. Google Play Billing / in-app purchases
In Wortavia version 1.3.0, you can optionally make the one-time Google Play purchase “Remove ads permanently”. It removes automatic advertising interruptions. Voluntary rewarded ads remain available. Coin packs are not offered in this version. Google Play handles payment; Tavirio Games does not receive full card or bank details.
For purchase validation, restoration and subsequent checks, the app sends its package identifier, product identifier, Google Play purchase token, purchase source and, where available, order identifier to Tavirio Games' purchase-verification service over HTTPS. This service is hosted on Supabase and checks purchase and acknowledgement status with Google Play. Confirmed refunds that remove the entitlement and revocations are also checked periodically with Google Play.
The service's database stores an internal record identifier, a SHA-256 hash of the purchase token, package and product identifiers, purchase, acknowledgement and entitlement status, verification timestamps, refund/revocation information and information about updates. The full purchase token and order identifier are processed for validation but are not persisted in this database. The full token can remain in private app storage on your device for later revalidation; it is excluded from game-save exports.
Purchase data is used to provide and restore the purchased entitlement, prevent duplicate or invalid grants and apply confirmed refunds or revocations. Normal game progress, coins, statistics and streaks are not sent to this service. No Wortavia account is required. Temporary service errors are not treated as evidence of a refund.
6. Google Play In-App Review
Wortavia may open the official Google Play in-app review feature. Using it is voluntary. Reviews and ratings you submit are processed through Google Play. In closed tests, feedback may be available privately to the developer; in production, a review may be published according to Google Play's settings.
7. Sharing and reminders
Wortavia can offer an invitation or a daily-result card through Android's share dialog. Only when you select a target app does Android pass the selected content to that app. Tavirio Games does not read your contacts or receive recipient information from this feature.
If you enable the optional daily reminder and grant notification permission, Wortavia schedules a reminder on your device. You can turn it off in the app settings or Android settings. This feature does not require an account or a Tavirio Games notification server.
8. Recipients, hosting and transfers outside the EEA
Use of the Google services above may involve transfers to Google companies and their service providers. Google operates globally. See Google's data-transfer frameworks.
Tavirio Games uses Supabase for hosting the purchase-verification service and its PostgreSQL database. Supabase describes its processing on behalf of customers in its Data Processing Addendum, which names Supabase Pte. Ltd. and sets out safeguards for international transfers, including standard contractual clauses where applicable. The purchase-verification database is hosted in Ireland. This database region does not guarantee that all hosting, support or subprocessor processing is confined to the EEA.
When the purchase service is accessed, hosting/gateway logs contain the IP address, approximate city/region derived from the connection, request time, route, user-agent information, response status and technical performance/diagnostic data. These records are used for service operation, troubleshooting and abuse prevention. Request limiting temporarily stores counters associated with a hashed purchase identifier and time windows. The purchase-verification code does not log full purchase tokens, order identifiers or secret credentials.
9. Retention
Local game data remains on your device until you delete it, clear app data or uninstall the app. Separately exported save files must be deleted at their storage location. Google applies its own retention rules to data processed under its responsibility. Support emails are retained as needed to handle requests and applicable legal obligations.
Server-side purchase and entitlement records are independent of local game data. There is currently no automatic time-based deletion of these records. Active records support lifetime access and restoration; revocation records prevent an invalid purchase from being activated again. Clearing local data does not erase these server records. Deletion requests are reviewed as explained below.
Old rate-limit counters are removed when a new global request is processed and the counter window is more than 15 minutes old. This does not guarantee deletion during inactivity. Technical hosting logs are retained for one day under the Supabase plan in use; extended retention has not been configured. Local app-data deletion does not delete those logs or provider backups.
10. Your rights and deletion requests
Subject to applicable law, you may have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn for the future. Contact taviriogames@gmail.com to exercise your rights, including requests relating to server-side purchase and entitlement records.
We review the request and safely identify the relevant purchase. Do not send passwords, full purchase tokens or card details by email. Necessary retention and the effects on purchase validation and restoration are considered when handling the request. Server data is not erased through an automatic in-app deletion button. Google provides controls for data it processes directly. See Data Deletion.
11. Complaints
You may complain to a data protection authority. In particular, the authority responsible for the controller is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany; www.ldi.nrw.de.
12. Security and purposes
According to Google, transfers made by the integrated advertising SDK are encrypted using TLS. App-to-verifier and verifier-to-Google transfers use HTTPS; the backend database connection uses certificate-checked TLS. Regular game progress remains local and no Wortavia account is required.
Purchase validation and restoration are necessary to provide the service requested with the purchase (Article 6(1)(b) GDPR). Necessary abuse prevention and technical operational diagnostics are based on legitimate interests in a secure, reliable service and preventing invalid grants (Article 6(1)(f) GDPR), unless your interests and fundamental rights override those interests. Where advertising requires consent, that consent is the basis for the corresponding processing (Article 6(1)(a) GDPR) and is managed through UMP.
13. Changes to this policy
This policy will be updated if features, integrated services, legal requirements or the specific advertising or purchase configuration change. The current version will be published at this URL.
Last updated: 11 October 2026 · Wortavia version 1.3.0